Session cookies - cookies that last only for the duration of the current session - are arguably not a tracking tool under the spirit of the EU's data protection efforts.

Under old EU cookie rules, they appeared to be exempt from the requirement to get the user's consent:

Cookies clearly exempt from consent according to the EU advisory body on data protection- WP29pdf include:

  • user‑input cookies (session-id) such as first‑party cookies to keep track of the user's input when filling online forms, shopping carts,
    etc., for the duration of a session or persistent cookies limited to
    a few hours in some cases
  • authentication cookies, to identify the user once he has logged in, for the duration of a session
  • user‑centric security cookies, used to detect authentication abuses, for a limited persistent duration
  • multimedia content player cookies, used to store technical data to play back video or audio content, for the duration of a session
  • load‑balancing cookies, for the duration of session
  • user‑interface customisation cookies such as language or font preferences, for the duration of a session (or slightly longer)
  • third‑party social plug‑in content‑sharing cookies, for logged‑in members of a social network.

I realize there are few things that one can say with certainty about GDPR, but are there any indications on how session cookies are treated under the new law?

2 Answers 2


I've been looking at this too, and I believe they fall under the category of pseudonymous data (most information taken from this helpful page):

Article 4(5)
‘pseudonymisation’ means the processing of personal data in such a manner that the personal data can no longer be attributed to a specific data subject without the use of additional information, provided that such additional information is kept separately and is subject to technical and organisational measures to ensure that the personal data are not attributed to an identified or identifiable natural person;

And regarding dealing with pseudonymous data:

Recital 26 (excerpt)
Personal data which have undergone pseudonymisation, which could be attributed to a natural person by the use of additional information should be considered to be information on an identifiable natural person. To determine whether a natural person is identifiable, account should be taken of all the means reasonably likely to be used, such as singling out, either by the controller or by another person to identify the natural person directly or indirectly.To ascertain whether means are reasonably likely to be used to identify the natural person, account should be taken of all objective factors, such as the costs of and the amount of time required for identification, taking into consideration the available technology at the time of the processing and technological developments.

My interpretation is this:

  • A session cookie could conceivably be paired up with data stored by the web server to become identifiable (pseudonymous).
  • Considering the means required, the time taken, and the low benefits to do so, we can deem it not reasonably likely, therefore a session ID is not identifiable.

More from Recital 26 The principles of data protection should therefore not apply to anonymous information, namely information which does not relate to an identified or identifiable natural person or to personal data rendered anonymous in such a manner that the data subject is not or no longer identifiable. This Regulation does not therefore concern the processing of such anonymous information, including for statistical or research purposes.

They don't regulate you if the data subject is not or no longer identifiable.

Of course this would need to be evaluated on a cookie-by-cookie basis. The personal information at stake is vastly different between a web server session cookie, and a Google or Facebook tracking cookie, and hence reasonably likely changes.


Online PDF of full official regulation:

Online viewer for regulation:

Page discussing anonymization and pseudonymization:


Exemption from consent under EU GDPR for session cookies needs to be evaluated on a cookie-by-cookie basis. You have to comply to both the EU GDPR and the ePrivacy Directive: https://gdpr.eu/cookies/

If session-cookies are related to services such as Google or Facebook, as of today, they are not considered EU GDPR compliant by EU authorities. If personal data are collected (i.e.: IP address) a privacy breach occurs. Further reading: https://piwik.pro/blog/is-google-analytics-gdpr-compliant/

In brief, is you use session-cookies from EEA territories and whitelisted countries it seems that you are considered exempt under the EU GDPR. If you use third parties session-cookies from countries such as New Zeland or United States you are not exempt under the EU GDPR. Country of origin matters.


Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.